Malicious PDF — malware analysis report

Static analysis result for SHA-256 18e88bc554507be3…

MALICIOUS

PDF

71.6 KB Created: 2020-12-15 15:42:21 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-12
MD5: 18d299f61d3ae767f3107d593184c239 SHA-1: 4c153a9176cac6bc29c455ed909484d9a074ac24 SHA-256: 18e88bc554507be3a634c2bfdc6032c10a10d1f6e39172e187f2bd6711c81a8a
202 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a link to a known malicious redirector, ggtraff.ru, disguised as an exam date sheet. The 'SE_URGENCY_LURE' and 'SE_PASSWORD_ARCHIVE_LURE' heuristics suggest a social engineering attempt to trick the user into clicking the link or handling a password-protected archive. The ML classifier and ClamAV detection strongly indicate malicious intent, likely for phishing or malware delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
  • Urgency / deadline lure low SE_URGENCY_LURE
    Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ggtraff.ru/aws?utm_term=compartment+exam+2018+date+sheet In PDF document text
    • https://cdn-cms.f-static.net/uploads/4417321/normal_5fb31e43eb506.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4368770/normal_5f8947f6daf24.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://s3.amazonaws.com/wumodukubaru/university_of_miami_health_insurance_waiver.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbcfe5ecc750a3b5a068192/1606221407778/lake_hamilton_high_school_address.pdfIn PDF document text
    • https://s3.amazonaws.com/geraromu/amazon_kindle_paperwhite_3_supported_formats.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc71b96bcf5f06bcb7712bb/t/5fcb146c6e74d26c6ff90cbd/1607144559374/94280218556.pdfIn PDF document text
    • https://s3.amazonaws.com/kakekojezutok/mathworksheetsland_composition_of_functions_answers.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc0e2740a2757459be2c9b8/t/5fc118a7f81c9a2a0cc8f7cf/1606490281696/www_engvid_com_english.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc07dde27a199023ab34438/t/5fc1cf953570fb44d145a628/1606537110269/recon_ron_pullup_plan.pdfIn PDF document text
    • https://s3.amazonaws.com/sazariwapa/netflix_error_m7353-5101.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbe056afa04221c71e79287/1606288746652/4300448608.pdfIn PDF document text
    • https://s3.amazonaws.com/tuzakifezara/49433693429.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000c2f6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC2F6 5516 bytes
SHA-256: 50e3d2d3eca588418a33379cd97bbc47be2b69ac4b4881a2ee603a2f98de3f16
font_01_sfnt_off0000d578.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD578 1936 bytes
SHA-256: 73983ccd477f0e4c07634362c0f9f13a23cea415a26bff37f7f125d59a681190
font_02_sfnt_off0000debb.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDEBB 10740 bytes
SHA-256: e7d2f6882596afd75c82588ed43a11bf1bc36aea36d7d97de796e09e62691bf0
font_03_sfnt_off00010370.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10370 4324 bytes
SHA-256: 9f355172d696dda274cac500966718f112ce76951f19577ac4888987ea6471b2

Open this report in the interactive analyzer, or submit your own file for analysis.